An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities

Static application security testing SAST tools help developers find vulnerabilities before deployment, but false positives create substantial triage effort. We study whether CodeQL false positives in Java security analysis form recurring, explainable patterns that can be reduced by refining the...